Unauthorised AJAX Calls via Freemius

Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...

WordPress Meridia theme < 2.2.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Meridia theme versions 2.2.7. Solution Update the WordPress Meridia theme to the latest available version at least 2.2.7...

WordPress XT Ajax Add To Cart for WooCommerce plugin <= 1.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress XT Ajax Add To Cart for WooCommerce plugin versions = 1.0.3. Solution Update the WordPress XT Ajax Add To Cart for WooCommerce plugin to the latest available version at least 1.0.4...

WordPress Nokke theme < 1.0.11 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Nokke theme versions 1.0.11. Solution Update the WordPress Nokke theme to the latest available version at least 1.0.11...

WordPress All in One Video Downloader plugin <= 1.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress All in One Video Downloader plugin versions = 1.0.2. Solution No patched version available...

WordPress FooBox Image Lightbox plugin < 2.7.17 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress FooBox Image Lightbox plugin versions 2.7.17. Solution Update the WordPress FooBox Image Lightbox plugin to the latest available version at least 2.7.17...

WordPress SV Forms plugin < 1.8.10 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SV Forms plugin versions 1.8.10. Solution Update the WordPress SV Forms plugin to the latest available version at least 1.8.10...

WordPress Page Studio Lite Plugin plugin <= 1.0.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Page Studio Lite Plugin plugin versions = 1.0.6. Solution No patched version available...

WordPress ClinicalWP Core plugin <= 1.0.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress ClinicalWP Core plugin versions = 1.0.5. Solution No patched version available...

WordPress Utilitify – Supercharge Your WordPress Site With Powerpack WordPress Utilities plugin <= 1.0.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Utilitify – Supercharge Your WordPress Site With Powerpack WordPress Utilities plugin versions = 1.0.6. Solution Update the WordPress Utilitify – Supercharge Your WordPress Site With Powerpack WordPres...

WordPress Content Sidebars plugin <= 1.6.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Content Sidebars plugin versions = 1.6.7. Solution Update the WordPress Content Sidebars plugin to the latest available version at least 1.6.8...

WordPress Smart Variations Images & Swatches for WooCommerce plugin < 5.1.10 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Smart Variations Images & Swatches for WooCommerce plugin versions 5.1.10. Solution Update the WordPress Smart Variations Images & Swatches for WooCommerce plugin to the latest available version at lea...

WordPress Books Gallery – Best Books Showcase & Library Plugin for WordPress plugin < 3.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Books Gallery – Best Books Showcase & Library Plugin for WordPress plugin versions 3.6. Solution Update the WordPress Books Gallery – Best Books Showcase & Library Plugin for WordPress plugin to the...

WordPress Shuban theme <= 1.1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Shuban theme versions = 1.1.2. Solution No patched version available...

WordPress Order and Inventory Manager for WooCommerce plugin <= 1.3.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Order and Inventory Manager for WooCommerce plugin versions = 1.3.4. Solution No patched version available...

WordPress Google My Business Manager plugin <= 1.1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Google My Business Manager plugin versions = 1.1.2. Solution No patched version available...

WordPress WP Mobile Menu plugin <= 2.8.2.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Mobile Menu plugin versions = 2.8.2.6. Solution Update the WordPress WP Mobile Menu plugin to the latest available version at least 2.8.2.7...

WordPress WordPress WooCommerce Sync for Google Sheet plugin <= 1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress WooCommerce Sync for Google Sheet plugin versions = 1.0. Solution No patched version available...

WordPress "The best plugin for restrict content, support all Custom Post Types and Elementor – Password Protected" plugin <= 1.0.16 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "The best plugin for restrict content, support all Custom Post Types and Elementor – Password Protected" plugin versions = 1.0.16. Solution No patched version available...

WordPress Add Expires Headers & Optimized Minify plugin < 2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Add Expires Headers & Optimized Minify plugin versions 2.5. Solution Update the WordPress Add Expires Headers & Optimized Minify plugin to the latest available version at least 2.5...